CryptoPaste is a secure pastebin service inspired by CryptoBin. Like CryptoBin, CryptoPaste strives to be a secure, stable and clean pastebin service, especially now that CryptoBin has seemingly shut its doors indefinitely. The goal is to perform all encryption, decryption, and data handling in the user's browser so that the CryptoPaste host has both plausible deniability and the inability to comply with court orders or takedown requests.
CryptoPaste is a HackThisSite project.
- Pastes are encrypted in-browser before being sent to the server
- No passwords stored
- All identifying information is anonymized
- Expired content is deleted forever
- Web cron available
- Template override supported
An active demonstration of CryptoPaste can be found at https://cryptopaste.org
- PHP >= 7.0
- Composer
- MySQL / MariaDB
- Clone or download this repository, then
cdinto the directory, and run
$ composer install
Because CryptoPaste uses the Symfony framework, Composer will automatically prompt you for configuration settings. Unfortunately this does not include definitions in the prompts, so please read the comments in app/config/parameters.yml.dist for an explanation of what the configuration settings are.
If you want to change the configuration settings later (i.e. changing to a DB user will limited permissions), they are saved in the app/config/parameters.yml file.
- Install the database using the following command:
$ php bin/console doctrine:migrations:migrate
This will install the database schema using the username and password you supplied in step 1. The database user you specified will need enough permissions to create the database and so forth. If you want to specify a different user to do this, edit the app/config/parameters.yml file.
- Edit your
nginx.confand make it look something like the following:
http {
# These maps anonymize IP addresses in nginx logs
map $remote_addr $ip_anonym1 {
default 0.0.0;
"~(?P<ip>(\d+)\.(\d+)\.(\d+))\.\d+" $ip;
"~(?P<ip>[^:]+:[^:]+):" $ip;
}
map $remote_addr $ip_anonym2 {
default .0;
"~(?P<ip>(\d+)\.(\d+)\.(\d+))\.\d+" .0;
"~(?P<ip>[^:]+:[^:]+):" ::;
}
map $ip_anonym1$ip_anonym2 $ip_anonymized {
default 0.0.0.0;
"~(?P<ip>.*)" $ip;
}
log_format anonymized '$ip_anonymized - $remote_user [$time_local] '
'"$request" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent"';
access_log /var/log/nginx/access.log anonymized;
}
server {
listen 80;
server_name _;
access_log /var/log/nginx/access.log anonymized;
root /path/to/cryptopaste/web;
index app.php;
location ~ /\.ht {
deny all;
}
location / {
try_files $uri /app.php$is_args$args;
}
location ~ ^/app\.php(/|$) {
fastcgi_pass unix:/var/run/php-fpm.sock;
fastcgi_split_path_info ^(.+\.php)(/.*)$;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_script_name;
fastcgi_param SERVER_NAME $host;
}
}
- If you chose not to enable the web cron, add an entry to your crontab to ensure deletion of expired pastes and sessions. Here is an example crontab entry that is run every hour as the
www-datauser:
0 * * * * www-data /usr/bin/php /path/to/cryptopaste/bin/console cron:run
Because Silex is now end-of-life, CryptoPaste v1.0 is a complete recode in the Symfony 3.4 framework. This has resulted in some major changes, but your data should be portable from a v0.x version of CryptoPaste.
CryptoPaste v1.x no longer supports SQLite. If you were using SQLite, please convert it to a MySQL database, table name of cryptopaste, and follow the upgrade procedure below.
-
Make sure to backup your database and your
config.inifile! You will need the data from yourconfig.iniin the next steps. -
Delete your old v0.x CryptoPaste installation, but do not delete your database!
-
Follow all of the instructions for Installation above, including for cron jobs and nginx settings. When prompted for configuration settings during the
composer installphase, use the values from yourconfig.ini. You will need to provide MySQL credentials for a user that can create and alter tables. -
When you run the
bin/console doctrine:migrations:migratecommand from the Installation instructions, this will automatically convert your database for CryptoPaste v1.x.
-
Make sure you backup your database and
app/config/parameters.ymlfile! -
If you cloned this repository,
cdinto your CryptoPaste installation directory and rungit pull. If not, you will need to clone or download this repository to a new directory, then move your oldapp/config/parameters.ymlfile and any custom templates into your that new directory. -
Next, run
$ composer install
Because CryptoPaste uses the Symfony framework, Composer will automatically prompt you for any new configuration settings. Unfortunately this does not include definitions in the prompts, so please read the comments in app/config/parameters.yml.dist for an explanation of what the configuration settings are.
If you want to change the configuration settings later (i.e. changing to a DB user will limited permissions), they are saved in the app/config/parameters.yml file.
- Update the database using the following command:
$ php bin/console doctrine:migrations:migrate
This will update the database schema using the username and password specified in your app/config/parameters.yml file. The database user you specified will need enough permissions to modify the database and so forth. If you want to specify a different user to do this, edit the app/config/parameters.yml file.
- Clear the CryptoPaste application cache by running the following command:
$ php bin/console cache:clear
Note that all template files are written in Twig 2.0. You can find the documentation for it here.
All default template files reside in app/Resources/views/default/. If you want to override any file here, simply copy the file to the custom/ directory one level up and modify as needed. For example, if you want to override the FAQ page, you would copy app/Resources/views/default/pages/faq.html.twig to app/Resources/views/custom/pages/faq.html.twig.
If you want to add custom static pages, i.e. a privacy policy or terms of service, you can do that quite easily as described below.
First, create a file in app/Resources/views/custom/pages/ that must end in .html.twig. The part before .html.twig will become the page slug, or identifier, used in the URL and menu. For example, if you create app/Resources/views/custom/pages/privacy.html.twig, then "privacy" becomes the slug.
Two Twig settings must exist within a custom page:
- extends - Must be set exactly as shown below in the example
- content block - The HTML to display
There are also some optional settings:
- title - Page title that shows up in the
<title>HTML tag - breadcrumb - Breadcrumb that appears on the left side of the top menu bar. Hash-map of two values:
- icon - Fontawesome icon (reference)
- text - Text to show in the breadcrumb
- head block - HTML content to put just before the
</head>closing tag - footerjs block - HTML content to put just before the
</body>closing tag
Shown below is an example of a privacy policy custom page.
{% extends ["custom/_template.html.twig", "default/_template.html.twig"] %}
{% set title = "Privacy Policy" %}
{% set breadcrumb = {'icon': 'lock', 'text': 'Privacy Policy'} %}
{% block content %}
... privacy policy HTML ...
{% endblock %}
All page URL slugs are prefixed with /p/, such as /p/privacy for the above privacy policy page (if your CryptoPaste is accessible at http://cryptopaste/ then this would be http://cryptopaste/p/privacy).
If your page filename starts with an underscore (_), then the page will not be visible and will return a 404 error.
If you want your custom page or an outside URL to be visible in the top menu bar, you will need to create a app/Resources/views/custom/_menu.yaml.twig file. You can copy the default app/Resources/views/default/_menu.yaml.twig to start and modify as needed. You can also use this to hide the default FAQ page if you don't want to show it.
The _menu.yaml.html file contents must start with a menu key, and each menu item is a list of two keys. You must have the name key set, and either slug or url:
- name - The name to show in the menu
- slug - The slug of your custom page (the part of the filename just before the
.html.twigextension) - url - A URL to point to
Shown below is an example of a custom menu with the default FAQ page, a privacy policy custom page, and a link to an outside website. Note that this list is ordered top-to-bottom == left-to-right. So the menu example below would render the menu as: 'HackThisSite | Privacy Policy | FAQ | New Paste' ('New Paste' is always shown).
menu:
-
name: 'HackThisSite'
url: 'https://www.hackthissite.org'
-
name: 'Privacy Policy'
slug: privacy
-
name: 'FAQ'
slug: faq
If a menu slug starts with an underscore (_), that menu item will be hidden.
If you don't want to show anything in the menu except the 'New Paste' button, simply create an empty _menu.yaml.twig file in the custom/ folder.
- (Need Help!) Write legitimate testing
- (Need Help!) Fix the UI to have better responsive scaling and other improvements
CryptoPaste is licensed under the GNU General Public License v3.0. More details are in the LICENSE file.
CryptoPaste uses the following technologies:
- Symfony framework
- Composer, phpUnit
- Client-side JavaScript libraries and frameworks:
- Bootstrap and jQuery
- AES encryption and password generation from the Stanford Javascript Crypto Library
- AES backward compatability by Moveable Type
- Syntax highlighting by Highlight.js
- Password strength testing by zxcvbn
- smoothscroll polyfill
- clipboard.js
- Travis-CI, CLA Assistant